When data crosses a network it can be damaged in two quite different ways. Noise, faulty hardware and software bugs can flip bits or truncate messages by accident, and an attacker positioned on the path can alter them deliberately. Data integrity is the assurance that what arrives is exactly what was sent. It is related to confidentiality, which keeps data secret, but the two are different properties and neither guarantees the other. A message can be perfectly encrypted and still be modified in transit if nothing checks it, and a message can be perfectly intact while visible to everyone on the network. Secure and reliable transmission needs mechanisms for each property, designed to work together.
Which mechanisms protect integrity?
The simplest tools are error-detecting codes. A cyclic redundancy check, used in many link-layer protocols, detects accidental corruption efficiently, but it offers no protection against a deliberate attacker, who can alter the data and recompute the check. Cryptographic hash functions produce a fixed-size fingerprint of a message that changes unpredictably if any bit changes, which suits verifying downloaded files. To protect against an active attacker the check must depend on a secret key. A message authentication code, such as HMAC, combines the message with a shared key, so only someone holding the key can produce a valid tag. Digital signatures serve the same purpose when the verifier should not hold a signing secret.
Does encryption keep data intact?
Not by itself. Some encryption modes are malleable, meaning an attacker can flip bits in the ciphertext and cause predictable changes in the decrypted data without knowing the key. For this reason modern protocols use authenticated encryption, such as AES in Galois/Counter Mode or ChaCha20 with Poly1305, which encrypts the data and attaches an authentication tag in a single operation. The receiver verifies the tag before using any of the plaintext and rejects the message if it fails. Transport Layer Security applies this approach to every record it sends, which is why it protects both confidentiality and integrity. Designers should prefer these combined constructions to assembling encryption and checking from separate parts.
Common failure modes
Integrity mechanisms fail in recognisable ways. Weak checks, such as the short checksums used in some transport protocols, can miss certain corruptions, so end-to-end verification at the application layer remains valuable even when lower layers already check. Replay attacks resend a valid, authentic message at a harmful moment, which requires counters, timestamps or nonces to detect. Truncation can drop the final part of a message or stream, and downgrade attacks push two parties into weaker settings. Keys can be mismanaged, reused across purposes or leaked, which nullifies the guarantees they were meant to provide. Finally, systems sometimes log and ignore failed verification, which defeats the purpose of having it.
Why it matters
Decisions in finance, healthcare, industrial control and software updates all depend on data that has not been changed on the way. Layering simple error detection at the link, authenticated encryption in the transport and application-level checks on important data creates defence in depth against both accidents and attackers. The aim is that a corrupted message is rejected loudly instead of being accepted quietly. A system that logs every failed verification and alerts on unusual rates also gains an early warning that something on the path is faulty or hostile.
Encryption hides a message. Integrity checks are what tell you whether to believe it.
